search

valkey-io / valkey-doc

Other
17 stars 25 forks source link

`/topics/security.md` has misnaming, suggests deprecated configuration, and links to something resolved in 3.2 #131

Closed stockholmux closed 3 days ago

stockholmux commented 1 month ago

During pre-publishing review (#91), I noticed the following issues with /topics/security.md

The recommended authentication method, introduced in Valkey OSS 6.0, is via Access Control Lists

This should be 'Redis OSS 6.0' not 'Valkey OSS 6.0'

Disallowing specific commands

This section talks about using rename-command to disallow specific commands. According to valkey.conf this deprecated.

This is a security issue that may lead to the ability to compromise the system and/or run untrusted code as the same user as Valkey is running.

The linked article is from 8.5 years ago and indicates that protected mode in Redis 3.2 largely fixes this problem. Is this relevant in 2024?

zuiderkwast commented 2 weeks ago

Good findings. I'll delete all that outdated information.

I think we don't need to mention "introduced in Valkey OSS 6.0", because this is the oldest version still supported, meaning it's now included in all supported versions. I'm deleting this reference.